{"id":"CVE-2002-1025","aliases":["EUVD-2002-1014","GHSA-4jfh-2hwx-hrmr"],"status":"published","title":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in...","description":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02009,"percentile":0.80969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2002-10-04T04:00:00Z","modified":"2026-06-16T21:58:35Z","products":[{"vendor":"macromedia","product":"jrun"}],"references":[{"url":"http://www.macromedia.com/v1/handlers/index.cfm?ID=23164","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.osvdb.org/5028","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/5134","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","Vendor Advisory"]},{"url":"http://online.securityfocus.com/archive/1/280062","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0138.html","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred"]},{"url":"http://www.iss.net/security_center/static/9459.php","tags":["vdb-entry","x_refsource_XF","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-1025"},{"url":"https://github.com/advisories/GHSA-4jfh-2hwx-hrmr"}],"sources":{"cve":[{"id":"CVE-2002-1025","description":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.","status":"published","published":"2003-04-02T05:00:00Z","modified":"2024-08-08T03:12:16.956Z","updated_at":"2026-11-02T14:33:54.972584Z"}],"euvd":[{"id":"EUVD-2002-1014","description":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.","status":"published","published":"2003-04-02T05:00:00Z","modified":"2024-08-08T03:12:16Z","updated_at":"2026-11-03T01:14:58.174731Z"}],"ghsa":[{"id":"GHSA-4jfh-2hwx-hrmr","title":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in...","description":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.","status":"published","published":"2022-04-30T18:20:22Z","modified":"2023-01-30T05:06:20Z","updated_at":"2026-11-02T14:47:28.159322Z"}],"nvd":[{"id":"CVE-2002-1025","description":"JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.","status":"published","published":"2002-10-04T04:00:00Z","modified":"2026-06-16T21:58:35.273Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:42.827505Z"}]}}